AIKIDO-2026-946256

TL;DR

When resolving a tool call, CompletionExtension reads the import_path field of a Tool parsed from rendered template output and resolves it with importlib.import_module() before invoking the resulting callable. Prompts loaded from untrusted sources such as shared Redis or file-based registries can supply an arbitrary import path like os.system, so a matching tool call executes attacker-chosen Python with attacker-supplied arguments. This yields code execution in applications that load prompts from influenced storage. The fix removes dynamic importing entirely and resolves tool calls only against an allowlist of explicitly registered callables.